The Interoperability of Financial Data (Job Market Paper)

Elif Cansu Akoguz, Tarik Roukny, Tamas Vadasz

Interoperability of payment data — live third-party access to customers' transaction records — improves competition in credit. But it also reprices the market where the data is produced: payment services. We study this spillover in a model in which lenders must observe a firm's live payment flows to monitor it, and sharing infrastructure is costly to operate. Welfare depends on both markets: wide sharing is optimal when costs are low, no sharing when they are high. Sharing, however, never emerges voluntarily. A targeted (narrow) mandate lets the bank convert its credit-market rent into a payment-market premium, so the bank gains while firms can be net losers as payment prices rise. A wide mandate competes the premium away, yet it is never strictly necessary: under a narrow mandate, the rival provider widens the regime on its own wherever widening pays. Data-sharing mandates should therefore be scoped in light of their infrastructure costs and evaluated across the markets they connect.

Data collection and cyber-security in platforms: Enforcement or self-regulation?

(Working paper on request) 

Elif Cansu Akoguz, Tarik Roukny

We study data collection and cybersecurity in a platform economy. Data collection enables price discrimination but exposes users to membership and activity risks. Users' inability to observe the platform’s cybersecurity effort creates moral hazard and can lead to under-provision of cybersecurity. We show that data collection can benefit users despite price discrimination and data risk under strong efficiency gains from tailored pricing. The platform’s and users’ preferred collection regimes nevertheless need not coincide. Over-collection is always possible, while sufficiently strong network effects can also generate under-collection. The direction of disagreement is governed by membership risk; activity risk affects whether disagreement arises but not its direction. We then show that certification, which makes cybersecurity effort verifiable, may not only fail to eliminate protection inefficiencies but also give rise to new ones. Fixed security costs can prevent platforms from adopting protection that users value, whereas activity-scaled security costs can induce platforms to adopt protection that users would reject. A protection mandate corrects some under-protection but is self-limiting: platforms may respond by abandoning data collection altogether in response, potentially hurting user surplus. The results broadly highlight that welfare effects of data collection and cybersecurity policy depend critically on the fixed versus activity-scaled components of risk and cybersecurity cost.